s3.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'S3 buckets for static and user content'

Parameters:
  Environment:
    Type: String
    Description: Environment name
    AllowedValues:
      - dev
      - prod
    Default: dev

  ProjectName:
    Type: String
    Description: Project name for resource naming
    Default: myproject

  EnableVersioning:
    Type: String
    Description: Enable S3 versioning
    AllowedValues:
      - Enabled
      - Suspended
    Default: Suspended

  EnableLifecycle:
    Type: String
    Description: Enable lifecycle rules for user content bucket
    AllowedValues:
      - 'true'
      - 'false'
    Default: 'false'

  CloudFrontOAIId:
    Type: String
    Description: CloudFront Origin Access Identity ID (leave empty if not using CloudFront yet)
    Default: ''

Conditions:
  IsLifecycleEnabled: !Equals [!Ref EnableLifecycle, 'true']
  HasCloudFrontOAI: !Not [!Equals [!Ref CloudFrontOAIId, '']]

Resources:
  # Static Content Bucket
  StaticContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${ProjectName}-${Environment}-static-content'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: !Ref EnableVersioning
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - '*'
            AllowedMethods:
              - GET
              - HEAD
            AllowedOrigins:
              - '*'
            MaxAge: 3600
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-${Environment}-static-content'
        - Key: Environment
          Value: !Ref Environment

  StaticContentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Condition: HasCloudFrontOAI
    Properties:
      Bucket: !Ref StaticContentBucket
      PolicyDocument:
        Statement:
          - Sid: CloudFrontGetObject
            Effect: Allow
            Principal:
              CanonicalUser: !Ref CloudFrontOAIId
            Action: s3:GetObject
            Resource: !Sub '${StaticContentBucket.Arn}/*'

  # User Content Bucket
  UserContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${ProjectName}-${Environment}-user-content'
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      VersioningConfiguration:
        Status: !Ref EnableVersioning
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      CorsConfiguration:
        CorsRules:
          - AllowedHeaders:
              - '*'
            AllowedMethods:
              - GET
              - HEAD
              - PUT
              - POST
              - DELETE
            AllowedOrigins:
              - '*'
            MaxAge: 3600
      LifecycleConfiguration:
        Rules:
          - Id: AbortIncompleteMultipartUpload
            Status: Enabled
            AbortIncompleteMultipartUpload:
              DaysAfterInitiation: 7
          - Id: TransitionToIA
            Status: !If [IsLifecycleEnabled, Enabled, Disabled]
            Transitions:
              - TransitionInDays: 90
                StorageClass: STANDARD_IA
              - TransitionInDays: 180
                StorageClass: GLACIER
      Tags:
        - Key: Name
          Value: !Sub '${ProjectName}-${Environment}-user-content'
        - Key: Environment
          Value: !Ref Environment

  UserContentBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref UserContentBucket
      PolicyDocument:
        Statement:
          - Sid: DenyUnencryptedObjectUploads
            Effect: Deny
            Principal: '*'
            Action: s3:PutObject
            Resource: !Sub '${UserContentBucket.Arn}/*'
            Condition:
              StringNotEquals:
                s3:x-amz-server-side-encryption: AES256

Outputs:
  StaticContentBucketName:
    Description: Static content bucket name
    Value: !Ref StaticContentBucket
    Export:
      Name: !Sub '${AWS::StackName}-StaticContentBucketName'

  StaticContentBucketArn:
    Description: Static content bucket ARN
    Value: !GetAtt StaticContentBucket.Arn
    Export:
      Name: !Sub '${AWS::StackName}-StaticContentBucketArn'

  StaticContentBucketDomainName:
    Description: Static content bucket domain name
    Value: !GetAtt StaticContentBucket.DomainName
    Export:
      Name: !Sub '${AWS::StackName}-StaticContentBucketDomainName'

  StaticContentBucketRegionalDomainName:
    Description: Static content bucket regional domain name
    Value: !GetAtt StaticContentBucket.RegionalDomainName
    Export:
      Name: !Sub '${AWS::StackName}-StaticContentBucketRegionalDomainName'

  UserContentBucketName:
    Description: User content bucket name
    Value: !Ref UserContentBucket
    Export:
      Name: !Sub '${AWS::StackName}-UserContentBucketName'

  UserContentBucketArn:
    Description: User content bucket ARN
    Value: !GetAtt UserContentBucket.Arn
    Export:
      Name: !Sub '${AWS::StackName}-UserContentBucketArn'

  UserContentBucketDomainName:
    Description: User content bucket domain name
    Value: !GetAtt UserContentBucket.DomainName
    Export:
      Name: !Sub '${AWS::StackName}-UserContentBucketDomainName'